Type Alias OIDCOptions<TIdentity, TRequestData>

Permit non-HTTPS issuer and protocol endpoints for local development only.

Runs immediately before a login or refreshed session is persisted. Returning a session replaces the one that gets persisted and handed back to the caller (handleCallback's result, getSession's result); returning void keeps it unchanged. Use this to enrich or provision application data — e.g. upsert a user row — before the session is written, rather than after via a route's own callback hook.

Creates the browser-safe session from persisted authentication and request-only application data. Runs only when a public session is requested.

Controls retries for the initial (uncached) discovery document fetch, so a slow-starting identity provider — e.g. a 503 while it boots, or a connection error before its listener is up — doesn't fail every request until one happens to land after it's ready. Only network errors, 429, and 5xx responses are retried; 4xx responses and local validation failures (issuer mismatch, malformed URLs) fail immediately. Defaults to 5 attempts, starting at 500ms and doubling up to 5000ms.

Custom fetch implementation used for all OIDC network calls (discovery, token, userinfo, JWKS). Useful in dev to work around self-signed certs via a custom https.Agent — do not disable TLS verification in production.

Accepted ID-token signing algorithms. Defaults to the provider metadata, or RS256 when absent.

Loads application-owned data once for each authenticated request handled by handle. The result is exposed as event.locals.oidc.data and is never persisted in the OIDC session.

Maximum serialized cookie size before failing with guidance to use sessionStore. Defaults to 3800 bytes.

Once a discovery document has been fetched successfully, how often to refresh it in the background (stale-while-revalidate). The cached document keeps serving requests while a refresh is attempted or in-flight; a failed refresh is logged and retried after discoveryRetry.maxDelayMs, without disturbing the cache. Defaults to 3600 (1 hour). Set to 0 to disable background refresh.

Use a shared implementation in multi-instance deployments with rotating refresh tokens.

Resolves application identity after provider data validation on login and refresh.

Maximum lifetime of a local browser session. Defaults to 8 hours.

Maximum lifetime of the short-lived cookie that carries CSRF state, the PKCE verifier, and the OIDC nonce across the redirect to the provider and back. Defaults to 10 minutes.

If this expires (or the cookie is otherwise missing/mismatched, e.g. a second login started in another tab) before the browser returns from the provider, handleCallback restarts the login rather than failing outright - and the caller's original returnTo is not lost when that happens, since it also travels signed inside the state query parameter itself (see encodeOAuthState/decodeOAuthState in utils.ts), independent of this cookie's survival. Raising this value only reduces how often that restart happens; it is not required to fix a lost returnTo.

Additional audiences trusted in a multi-audience ID token.